Although many of the traditional cryptographic techniques may be applicable to wireless communications, these techniques suffer from the problem that the legitimate parties rely on the computational difficulty of obtaining a key by an eavesdropper, as opposed to its mathematical impossibility. As computational power available for eavesdropper increases, the effectiveness of such methods decreases. Additionally, such methods suffer from a problem that it is usually a simple matter to verify whether a particular guess is correct. Thus, it would be advantageous to construct a cryptographic technique that provides absolute (unconditional) secrecy, rather than one based on computational assumptions. One method for doing so has been well-known in prior art literature based on work of Maurer, Csiszar and Ahlswede and others. A brief description of the approach follows.
Suppose that two parties, Alice and Bob, have access to two sources of randomness, X and Y, which generate independent samples Xi and Yi, at predetermined times indexed by i. Suppose that Alice and Bob wish to generate a “perfectly secret” key by communicating over a public channel to which eavesdropper, Eve, has access. Moreover, Eve may also have access to another source of randomness, Z, generating independent samples Zi. The random source Z is presumably dependent on the random sources X and Y, but not as strongly as X and Y are cross-dependent on each other. Thus, intuitively, Alice and Bob share some advantage over Eve through the stronger inter-dependence of their random sources. Indeed it has been shown that Alice and Bob can exploit this dependence to generate a “perfectly secret” random key.
Without loss of generality, keys can be defined as bit sequences. A perfectly secret random key of length N bits is an N-bit sequence S, shared by Alice and Bob, such that anyone helse's (in our case there is only Eve) estimation about what this key sequence can be is roughly equiprobably distributed over all possible N-bit sequences, of which there are 2N.
Let V denote all the communication which takes place over the public channel; n be the number of time instances over which each of the three parties accumulate the output of the random sources they have access to; |S| be the length of the resulting key. Then for any ε>0, we seek a protocol such that for sufficiently large n, the following relationship holds:
                                          1            n                    ⁢                      H            ⁡                          (                                                S                  |                  V                                ,                Z                            )                                      >                                                          S                                      n                    -          ɛ                                    Equation        ⁢                                  ⁢        1            where H is the entropy of a random variable, well known from prior art literature on information theory. Note that Equation 1 is normalized to a single sampling of the random sources as this is the basic resource for key generation.
The quantity
            1      n        ⁢          H      ⁡              (                              S            |            V                    ,          Z                )              ,which by equation 1 can be equivalently thought of as [|S|/n], is called the secret key rate. Hereafter, the notion of length of secret key and the secret key rate are interchangeable, as appropriate by the context. Namely, whenever a length of a particular secret key is noted, it is to be understood that this is derived based on the observation of some specific quantity (n) of the underlying random variables. Whereas, a secret key rate is noted, the notion is one of the average number of secret key bits per random variable observation.
It is worth noting that there is a critical difference between the above definition of secrecy and the one that most modern crypto systems, including all public-key systems, rely on. Specifically, modern crypto systems rely on the fact that it may be extremely difficult from a computational complexity point of view to guess the crypto key. However, in most of these systems, once the correct guess is produced it is very easy to verify that this is indeed the correct guess. In fact, the work of Maurer and Wolf implies that this must be so for any public-key system, i.e. one where the encryption key is made public, while the decryption key is kept secret. To illustrate the point, consider the following simple example of what a public-key crypto system might be based on, while keeping in mind that most practical systems are much more sophisticated.
Let p and q be two large prime number and let s=pq. It is known that the problem of factoring a product of two large prime numbers is computationally difficult. Thus, one might envision that a public-key cryptography system may be constructed by having the communication destination choose p and q in secret and make their product s publicly available, which is then used as an encryption key for some encryption system which cannot be easily decrypted unless p and q are known. An eavesdropper wishing to intercept an encrypted message would likely start by attempting to factor s, which is known to be computationally difficult. Presumably the eavesdropper would either give up or so much time would pass that the secrecy of the message will no longer be an issue. Note however, that should the eavesdropper guess p, it will quite easily verify that it has the right answer. This ability to know the right answer once it is finally guessed, is what separates computational secrecy from “perfect secrecy”. Perfect secrecy means that even if the eavesdropper guesses the key correctly, it will have no ability to determine that it has indeed done so. Thus “perfect secrecy” is, in a very specific sense, a stronger notion of secrecy than what is prevalent in modern cryptography systems.
It is not obvious that such a protocol generating perfect secrecy in our scenario should exist. Nevertheless its existence, or the existence of many different protocols, has been established in the works of Ahlswede and Csiszar, Csiszar and Narayan and Maurer and Wolf. These prior works also give various upper and lower bounds on the number of random bits that can be generated per single sampling of the random sources under a wide range of assumptions.
The process for generating a perfectly secret key may then be outlined as follows. Alice and Bob first start by utilizing their joint randomness to establish a bit-string sequence S′ of whose inherent entropy from Eve's point of view is |S| bits with |S|≦|S′|. This is done using some number of public exchanges between Alice and Bob. In many cases, a single unilateral exchange is sufficient. The exact nature of the exchange depends on the nature of the jointly-random sources (X,Y,Z). This step is usually called information reconciliation.
Alice and Bob then possibly use another set of public exchanges, a single exchange is typically sufficient, to publicly agree on a function which transforms the sequence S′ into a perfectly secret string S. This is typically called privacy amplification. Alternatively, this function may be pre-agreed upon during the system design. In this case, it is assumed that Eve is aware of this.
An additional step occurring before the first step described above called advantage distillation may further be utilized, however as it is not pertinent here, nothing further is described in regards to it.
As specifically applied to a wireless communication system, the process needs further specification. While correlated random sources are a priori difficult to produce without prior communication, the wireless channel provides just such a resource in the form of the channel impulse response. Specifically, in certain communications systems, two communicating parties (Alice and Bob) will measure very similar channel impulse responses when communicating from Alice to Bob and from Bob to Alice (e.g., Wideband Code Division Multiple Access (WCDMA) Time Division Duplex (TDD) systems have this property). On the other hand any party not physically co-located with Alice and Bob is likely to observe a channel impulse response (CIR) that has very little correlation with that of Alice and Bob. This difference can be exploited for generation of perfectly secret keys. Also, it would be of interest to generate some number of perfectly secret bits per CIR measurement. Note that the CIR measurements have to be spaced fairly widely in time so as to be more or less independent.
Thus, there exists a need to design a system which explicitly extracts the secret bit string from a reciprocal wireless channel, while facing the challenge that under the worst case assumption applied in cryptography, an eavesdropper can intercept any bit exchanged between two wireless terminals, and is aware of the algorithm used by the two terminals to derive a secret key.
Yet another issue is that one may desire to extend the generation of a perfectly secret key from two transceiver terminals to a plurality of transceivers, such that the entire network of transceivers shares a common perfectly secret key, while only each pair shares the inherently unique channel properties. That is, each pair of transceivers generates a common random key, but these keys are different from pair to pair. This makes sharing information in such a network quite inefficient when the same information is to be broadcast to more then one receiver. The reason is that the message is encrypted with a different key for each receiver and thereafter appears as a different message and thus must be communicated separately to each receiver. In contrast, a message encrypted with a shared key can be multicast once and all of the legitimate receivers are able to decrypt the single transmission.